Gaming platform **Steam** is currently being exploited by threat actors employing 'ClickFix' attacks to infect users with cryptominers. These campaigns involve creating fake **Steam** accounts to post seemingly helpful solutions to common game-related issues like crashes or lost inventory items. ### The 'ClickFix' Deception In these attacks, users are instructed to open **PowerShell** as an administrator and run a specific command. This command, presented as a 'fix,' covertly downloads and launches an **XMRig** cryptominer executable on the victim's machine.  'ClickFix' is a social engineering technique where victims are persuaded to manually execute malicious commands under the guise of solving a technical problem. Its effectiveness lies in presenting a seemingly legitimate solution to an immediate user issue, often bypassing automated security measures that might otherwise block malicious code. ### Masquerading as a Windows Optimization Tool The PowerShell script used in this **Steam** campaign pretends to be a Windows optimization utility, often named "msf utility \ PC Opt." When executed, it displays a series of fake progress messages, claiming to perform various maintenance tasks such as cleaning temporary files, flushing DNS, updating drivers, and scanning for malware. These messages are designed to appear legitimate, with random pauses to simulate activity.  Most of these claimed functions are deceptive, merely displaying progress without actual execution. The true malicious activity is hidden within an 'Advanced-Optimization' function.  ### The Cryptominer's Installation Process The 'Advanced-Optimization' function first disables **TLS** certificate validation and verifies administrator privileges. Without elevated rights, the script exits with an error. Upon gaining administrator access, the script creates a directory `C:\Windows\Background` and adds it as an exclusion to **Microsoft Defender's** scanning functions. It also attempts to stop any existing scheduled tasks named 'XMRig-[computer name]' and terminate 'xmrig' or 'system' processes, along with deleting any `config.json` files in the installation directory. The purpose of this cleanup is unclear, but it may be to remove previous installations of the same malware or other miners. The malware then establishes a temporary outbound **Windows Firewall** rule to allow connections to `msfconfig[.]icu` over **TCP** port 443. It downloads the **XMRig** miner payload from `https://msfconfig[.]icu:443/tmp/system.txt` into a temporary file. After verifying the file's validity, it moves the executable to `C:\Windows\Background\system.exe`. To ensure persistence, a new scheduled task named "`XMRig-[computer name]`" is created, configured to launch `system.exe` with **SYSTEM** privileges every time Windows starts. ### Recommendations for Users Users are strongly advised against running **PowerShell** commands provided by unknown individuals on discussion forums, even when presented as solutions to technical problems. Individuals who may have executed such commands should inspect their systems for the `C:\Windows\Background` directory, a **Microsoft Defender** exclusion for this path, and any scheduled tasks prefixed with 'XMRig-'. If these indicators of compromise are found, an immediate antivirus scan is recommended to detect and remove the malware. If the antivirus fails to detect the miner, manual intervention is necessary: stop and remove the 'XMRig-[computer name]' scheduled task, remove the **Microsoft Defender** exclusion for `C:\Windows\Background`, and delete the folder and its contents. For complete assurance, a full operating system reinstallation may be the safest course of action, as the extent of other potential malicious activities cannot be fully determined.